Legal

Cookie Policy

Last updated: 14 September 2026

Privacy PolicyTerms of ServiceCookie Policy

1. The short version

We set three cookies to keep you signed in, and two optional ones that tell us which parts of KoalaCast get used. That's the whole list.

No advertising cookies. No tracking pixels. Nothing that follows you to other websites. If you decline the optional ones, the app works exactly the same.

2. What cookies are

Cookies are small files your browser stores when you visit a site. Some are needed for the site to work at all — a shopping basket that empties between pages isn't much use, and neither is a login that forgets you. Others are optional.

We use a small number of each, listed in full below.

3. Every cookie we set

NameWhat it doesHow longType
sb-access-tokenKeeps you signed in1 hourEssential
sb-refresh-tokenRenews your session so you aren't logged out mid-task60 daysEssential
sb-auth-tokenConfirms your identity to our serverSessionEssential
_gaTells return visits apart from new ones2 yearsOptional
_ga_*Groups your page views into a single visit2 yearsOptional

Your cookie choice itself is remembered in your browser's local storage under koalacast_cookie_consent. It isn't a cookie and never leaves your device.

4. The essential three

These hold your session. Without them the app can't tell one page view from another, so you would be asked to log in again constantly. They're set when you sign in and cleared when you sign out.

Because the service genuinely cannot function without them, they don't require consent under UK, EU, or Indian law. They contain a session token and nothing else — no personal details are stored in the cookie itself.

5. The optional two

We use Google Analytics to understand how KoalaCast is used — which pages get opened, where people give up, which features nobody touches. For a small team, that's most of what tells us what to build next.

What it does not do:

  • It doesn't record anything you type — no announcement text, no messages, no form answers.
  • It holds nothing about a specific child, payment, or bus.
  • Your IP address is anonymised before Google receives it.
  • We don't enable Google Signals or cross-device tracking.
  • None of it is used for advertising, and none of it is sold or shared.

These cookies are only set after you agree. If you decline, Google Analytics is never activated on your device, and nothing about how the app behaves changes.

Google processes this data under a Data Processing Agreement, and may transfer it to the United States under Standard Contractual Clauses. Their privacy policy covers what they do with it.

6. Google Maps, on one page

If your school uses bus tracking, that page loads Google Maps so the map can render. Google sets storage of its own when it does, which is outside our control and necessary for the map to work.

It only happens on that page, only while a bus is being tracked, and it doesn't run anywhere else in the app.

7. Changing your mind

When you first visit, you'll see a short banner with three options — accept, essential only, or choose for yourself. Refusing is one tap, the same as accepting.

To change your answer later, clear koalacast_cookie_consent from your browser's storage and the banner will appear again. You can also email us at hello@koalacast.io and we'll walk you through it.

Declining, or changing your mind later, has no effect on your account or on any feature of the platform.

8. Managing cookies in your browser

You can view, delete, and block cookies in your browser settings at any time. Clearing the KoalaCast session cookies will sign you out.

  • Chrome: Settings → Privacy and security → Cookies and other site data
  • Safari: Preferences → Privacy → Manage Website Data
  • Firefox: Settings → Privacy & Security → Cookies and Site Data
  • Edge: Settings → Cookies and site permissions → Cookies

You can also opt out of Google Analytics across every website using the Google Analytics Opt-out Browser Add-on.

9. Where you are, and what that means

The rules differ by country, so briefly:

  • India (DPDP Act 2023): We ask before setting anything optional, and you can withdraw that at any time.
  • EU and EEA (GDPR, ePrivacy): Same — explicit consent before any non-essential cookie, and refusing is as easy as accepting. Essential cookies are set without consent because the service cannot run without them.
  • United Kingdom (UK GDPR, PECR): The same rules as the EU apply.
  • United States, including California (CCPA / CPRA): We do not sell or share personal information through cookies, and we do not use them for cross-context behavioural advertising.

10. How long data is kept

Analytics data is deleted by Google after 14 months. The essential cookies expire as listed in the table above, or when you sign out.

11. Changes to this policy

If we add a cookie or change what an existing one does, we'll update this page and the date at the top. Material changes are emailed to workspace administrators at least 14 days before they take effect.

12. Questions and complaints

For anything about cookies: hello@koalacast.io

If you're in the EU or UK and think we've handled your data unlawfully, you can complain to your local data protection authority — the ICO in the UK, CNIL in France, the DPC in Ireland, and so on.

If you're in India, write to us at the address above and we'll respond within 72 hours.

© 2026 KoalaCast · hello@koalacast.io